Conceptual Interview Questions — All Categories
166 questions across 34 categories
The underlying mechanisms and trade-offs interviewers expect you to actually understand, not just recite.
What's the difference between kube-apiserver, kube-scheduler, and kube-controller-manager, and what breaks if each is unavailable?
IntermediateKubernetes6 min
How does etcd's quorum requirement affect control-plane node count, and why is an even number a bad choice?
IntermediateKubernetesEtcd6 min
What's etcd's actual role in a cluster, and what happens if it becomes unavailable?
BeginnerKubernetesEtcd5 min
What's the difference between a static pod and a normal pod, and why does the control plane often run as static pods?
IntermediateKubernetes5 min
How does HPA's scaling decision actually get computed from raw metrics — walk through what happens between a CPU spike and a new replica appearing?
IntermediateKubernetes6 min
Why does setting only limits (no requests) on a container break HPA's CPU-based scaling calculation?
BeginnerKubernetes5 min
A workload is constantly OOMKilled despite having an HPA configured — why doesn't horizontal scaling fix this, and what should you actually do?
IntermediateKubernetes6 min
What does a seccomp profile actually add on top of SecurityContext's capability restrictions, and when do you need one?
AdvancedKubernetes6 min
A pod doesn't pick up a ConfigMap change after it's updated — why, and how would you make the app actually reload it?
IntermediateKubernetes6 min
Why are Kubernetes Secrets only base64-encoded by default, not encrypted, and how would you actually protect them at rest?
BeginnerKubernetes5 min
Why should a CRD's status be a separate subresource from spec, and what belongs in status versus spec?
IntermediateKubernetes6 min
A custom resource is stuck in Terminating status indefinitely after being deleted — what's a finalizer, and how does it cause this?
AdvancedKubernetes7 min
How does an operator's reconciliation loop actually work, and why is it designed to be idempotent and level-triggered rather than event-driven?
IntermediateKubernetes6 min
A custom resource is deleted, but the Deployments and Services an operator created for it are left orphaned in the cluster — why doesn't Kubernetes clean them up automatically?
IntermediateKubernetes6 min
What's actually different about a CustomResourceDefinition versus a built-in Kubernetes resource like a Deployment?
BeginnerKubernetes5 min
What's the actual difference between a Pod and a Deployment in Kubernetes, and why would you almost never create a bare Pod directly in production?
BeginnerKubernetes6 min
How does a Service-not-routing-traffic failure mode differ between a plain ClusterIP Service and one fronted by an Ingress controller?
IntermediateKubernetes7 min
What's the difference between Kubernetes Endpoints and EndpointSlices, and why did Kubernetes introduce EndpointSlices?
IntermediateKubernetes6 min
A headless Service behaves completely differently for DNS resolution — what's different, and when do you need it?
IntermediateKubernetes6 min
What does a pod's ndots DNS setting default to, and how can it cause unexpectedly slow external DNS lookups?
AdvancedKubernetes7 min
How would you debug a Service routing failure differently if you were using a service mesh like Istio instead of plain kube-proxy-based Services?
AdvancedKubernetesIstio7 min
Why does Kubernetes require a CNI plugin at all — what job does it do that kube-proxy doesn't?
BeginnerKubernetes5 min
What's the difference between a Role/RoleBinding and a ClusterRole/ClusterRoleBinding, and when would you bind a ClusterRole at namespace scope on purpose?
BeginnerKubernetes5 min
Why doesn't a RoleBinding in namespace A grant access to namespace B, even though the ClusterRole it references is itself cluster-scoped?
IntermediateKubernetes5 min